CVE-2025-54314: 
Ruby vulnerability analysis and mitigation

CVE-2025-54314 is an OS command injection vulnerability in the Thor Ruby gem (a toolkit for building command-line interfaces) affecting versions before 1.4.0. The vulnerability exists in the merge method within lib/thor/shell/basic.rb, where a shell command is constructed using string interpolation with library-controlled inputs, potentially allowing unsafe shell command execution. It was published on July 20, 2025, and patched in Thor v1.4.0 released July 18, 2025. The NVD-assigned CVSS v3.1 base score is 2.8 (Low), while the GitHub Advisory Database initially scored it 7.8 (High) before the advisory was withdrawn on August 13, 2025 (Github Advisory, Oracle).

The root cause is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The vulnerable code in lib/thor/shell/basic.rb used Ruby string interpolation to construct a shell command: system %(#{merge_tool} "#{temp.path}" "#{destination}"), where merge_tool is derived from library input (e.g., the THOR_MERGE environment variable or configuration). This pattern allows shell metacharacters — such as quotes, spaces, or command separators — embedded in the merge_tool value to alter the intended shell command. The fix, applied in commit 536b790, replaces the interpolated string with a multi-argument system() call (system(merge_tool, temp.path, destination)), which bypasses shell interpretation entirely (Thor PR #897, Thor Commit). The attack vector is local, requires low privileges, and has high complexity, as the attacker must be able to influence the merge tool configuration.

Successful exploitation could allow a local attacker with low privileges to inject shell metacharacters into the merge tool command, potentially executing arbitrary OS commands in the context of the Thor process. The primary impact is limited integrity modification (CVSS score of 2.8), with no direct confidentiality or availability impact per the NVD scoring. However, the GitHub Advisory Database initially assessed a higher potential impact (C:H/I:H/A:H) before the advisory was withdrawn, reflecting theoretical worst-case scenarios if the merge tool input were attacker-controlled (Github Advisory, Oracle).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Github Advisory). The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Notably, the GitHub Advisory was withdrawn on August 13, 2025, after Thor maintainer rafaelfranca disputed the CVE, stating that the affected method can only be invoked with arguments controlled by Thor itself, and that an external attacker cannot access the vulnerable functionality (Thor PR #897).

The primary remediation is to upgrade the Thor gem to version 1.4.0 or later, which replaces the unsafe string-interpolated system() call with a multi-argument form that bypasses shell interpretation (Thor Release v1.4.0). As a workaround prior to upgrading, administrators should avoid configuring untrusted or user-supplied values for the THOR_MERGE environment variable or merge tool settings. Oracle has also addressed this CVE in the Oracle Solaris Third Party Bulletin (January 2026) for Oracle Solaris 11.4 (Oracle). OpenSUSE and other Linux distributions have similarly released updated packages for rubygem-thor to version 1.4.0.

Thor maintainer rafaelfranca publicly disputed the CVE on GitHub, stating: "Wait, why was a CVE emitted for this fix? None of the maintainers requested it. I don't think there is a CVE here. Thor is a CLI tool and this is used for user controller input, not random input from the internet." He also noted consideration of reverting the change due to it breaking legitimate merge tool configuration use cases (Thor PR #897). The GitHub Advisory (GHSA-mqcp-p2hv-vw6x) was formally withdrawn on August 13, 2025, with the explanation that the affected method can only be used with arguments controlled by Thor, and an external attacker cannot access the described functionality (Github Advisory). Despite the dispute, downstream projects such as OpenSUSE, Oracle Solaris, Puppet, and various Ruby ecosystem packages proceeded with patching to Thor 1.4.0 as a precautionary measure.